Агентная разработка без Governance опасна: трёхуровневый стек на практике

Autonomous AI agents that plan tasks, write and review code without constant developer oversight have made Governance a mandatory element of engineering infrastructure — not an optional add-on.

How an agent differs from a chat assistant

In chat-assistant mode, the developer personally checks every line: the model suggests — the human decides. An autonomous agent changes this scheme dramatically: it sets its own subtasks, writes the implementation, runs tests, and commits the result, making thousands of micro-decisions per hour.

A human simply cannot check them all. It is from this gap that the need for Governance emerges — a system not just of rules, but of processes: who sets the rules, how they are applied, who monitors compliance. According to the authors of the article on Habr, it is precisely at the transition from chat mode to autonomous mode that Governance changes its status: from "nice to have" to "mandatory."

Why a three-level stack is needed

The authors of the article built a concrete Governance stack for a sports venue booking platform using NestJS (backend) and Next.js (frontend). The platform was chosen deliberately: booking implies strict business logic — slots, overlaps, transactions — where an agent's mistake can be invisible yet critical.

The stack consists of three levels:

• Level 1 — Codebase: rules are embedded in the project through linters, architectural constraints, and conventions. The agent cannot violate them without triggering an explicit error.
• Level 2 — Agent behavior policies: a clear boundary between "the agent acts autonomously" and "the agent requests approval." The boundary is defined by the team in advance, not after an incident occurs.
• Level 3 — Observability and audit: full traceability of decisions. After each working session, the team sees exactly what the agent did, why, and what consequences it led to.

Without the third level, the first two become mere declarations: violations occur but remain invisible.

Why Governance is not bureaucracy

A common misconception: Governance is perceived as a bottleneck, an extra layer of approvals. In practice, it is the only way to maintain speed without losing control.

"Governance ceases to be a supporting tool and becomes a hard requirement," — the

Habr article states.

An autonomous agent reduces the cost of writing code, but simultaneously raises the cost of oversight. Without explicit policies, the team spends time sorting out consequences instead of building the product. On the booking platform, the specific risk is: the agent silently modifies the slot-overlap validation logic, and the error surfaces not in tests but in conflicting bookings for real users. The three-level stack makes such a scenario visible before — not after.

What this means

Agentic development is the next stage after Copilot and chat assistants, and it is already being deployed in real production projects. Engineering teams that do not build a Governance stack now will be forced to do so in crisis mode.

Frequently asked questions

What is Governance in development with AI agents?

Governance is not just a set of rules, but a system: agent behavior rules, processes for adopting them, and tools for monitoring compliance. Unlike "regulation," Governance includes architectural constraints, autonomy policies, and traceability — all together, not separately.

Why are rules in the code not enough on their own?

Rules without observability do not work: an agent can violate them, and the team will only learn about it from the consequences. The third level of the stack — audit and traceability — is no less important than the first two constraining levels.